Enforcement · Danish Data Protection Authority (Datatilsynet) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Vejle Municipality: Insufficient technical and organisational measures to ensure information security

€27,000 Fine
Vejle Municipality
DENMARK
Art. 32 GDPR
Data Breaches Public Authority Security IP Address Education Public Sector Processing Agreement Privacy by Design & Default
Jun 16, 2021 Source

How it connects

Related across sources

Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB News What Happened to the Risk-Based Approach to Data Transfers? Future of Privacy Forum Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU

Full text

The Danish DPA (Datatilsynet) has imposed a fine of EUR 27,000 on Vejle municipality. The Danish DPA had started investigations against the municipality after it had reported a data breach pursuant to Art. 33 GDPR. The municipal dental care service had sent automated welcome letters to both parents as part of the treatment of children, which contained the contact details of both parents. In this process, the municipality had not checked whether it was permitted to pass the information on to the other parent. In several cases, parents thus received the address of the other parent, regardless of whether the other parent had name and address protection. The DPA considered this to be a failure of the municipality to take technical and organizational measures to ensure adequate data protection.

Industry: Public Sector and Education

Original document at the source www.datatilsynet.dk

Similar Content